Game of Registrars: An Empirical Analysis of Post-Expiration Domain Name Takeovers Tobias Lauinger, Northeastern University; Abdelberi Chaabane, Nokia Bell Labs; Ahmet Salih Buyukkayhan, Northeastern University; Kaan Onarlioglu, www.onarlioglu.com; William Robertson, Northeastern University https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/lauinger This paper is included in the Proceedings of the 26th USENIX Security Symposium August 16–18, 2017 • Vancouver, BC, Canada ISBN 978-1-931971-40-9 Open access to the Proceedings of the 26th USENIX Security Symposium is sponsored by USENIX Game of Registrars: An Empirical Analysis of Post-Expiration Domain Name Takeovers Tobias Lauinger Abdelberi Chaabane Ahmet Salih Buyukkayhan Northeastern University Nokia Bell Labs Northeastern University Kaan Onarlioglu William Robertson www.onarlioglu.com Northeastern University Abstract zones of authority or trust. For example, controlling a domain name is often equivalent to gaining access to Every day, hundreds of thousands of Internet domain additional resources [44]. An assumption common to all names are abandoned by their owners and become avail- these approaches is that domain ownership is constant and able for re-registration. Yet, there appears to be enough perpetual. However, in actuality this is not true as domain residual value and demand from domain speculators to name registrations must be renewed and paid for on a give rise to a highly competitive ecosystem of drop-catch yearly basis. In fact, hundreds of thousands of expired services that race to be the first to re-register potentially domain names are deleted each day (e.g., over 75 k per desirable domain names in the very instant the old re- day in the popular com zone alone [24]). gistration is deleted. To pre-empt the competitive (and uncertain) race to re-registration, some registrars sell their Once a domain name has been deleted, it can be re- own customers’ expired domains pre-release, that is, even registered by any interested party on a first-come, first- before the names are returned to general availability. served basis. Schlamp et al. [44] showed how such re- These practices are not without controversy, and can registrations can be used to take over protected resources have serious security consequences. In this paper, we associated with these domains. Nikiforakis et al. [42] present an empirical analysis of these two kinds of post- discussed websites still attempting to include JavaScript expiration domain ownership changes.We find that 10 % code from third-party domains long after they had expired, allowing attackers to inject code into these sites. Lever et of all com domains are re-registered on the same day as al. [33] measured more formally how often re-registered their old registration is deleted. In the case of org, over 50 % of re-registrations on the deletion day occur during domains were associated with malicious behaviour. How- only 30 s. Furthermore, drop-catch services control over ever, by focussing on certain kinds of risk or malice, these 75 % of accredited domain registrars and cause more than studies do not illustrate the full scope of the issue. 80 % of domain creation attempts, but represent at most We argue that the problem goes beyond specific cases 9.5 % of successful domain creations. These findings of abuse related to re-registered domains. It also in- highlight a significant demand for expired domains, and cludes the much broader and more frequent category of hint at highly competitive re-registrations. undesirable behaviour akin to topics thoroughly studied Our work sheds light on various questionable practices by the security community, such as spam [32], search in an opaque ecosystem. The implications go beyond the engine poisoning [49], ISPs hijacking NXDOMAIN annoyance of websites turned into “Internet graffiti” [26], DNS responses [50], domain parking [2, 48], typo- as domain ownership changes have the potential to cir- squatting [1, 37, 47], and reuse of social media profile cumvent established security mechanisms. names [35, 36]. Re-registered domains appear to be pre- dominantly used for speculation and monetisation pur- poses, taking advantage of the residual traffic still reach- 1 Introduction ing the domains. Users who follow links from third-party websites or type in an address that they remember are Domain names are a key part of linking to content on taken to a new incarnation of the site that can be arbitrarily the Web, and they have an equally central role in naming different from the service that they actually wish to visit. services on the Internet, such as in email addresses. A In Section 4.4, we show that a majority of re-registered large number of security mechanisms and protocols have domains are parked and host nothing but advertisements. been devised that rely on domains to designate distinct ICANN called this undesirable practice “a form of Inter- USENIX Association 26th USENIX Security Symposium 865 net graffiti” [26]; domain parking is also known to pose their own systems in an “optimal strategical location” [4] higher-than-average risks to visitors [48]. physically close to the registry; these optimisations re- We believe it is important for the security community semble high-frequency trading in the financial industry. to better understand the big picture of domain ownership Drop-catch services are not without controversy. Some transfers and the implications for users, Internet abuse, registries actively discourage the practice (e.g., registrars and defences thereof. This paper provides a quantitative are penalised for failed uk registration requests [8]), while analysis of the “recycling” of expired domain names. We others at least implicitly encourage or facilitate it (e.g., show that this is a frequent phenomenon, causing a range Verisign makes available to its registrars lists of com and of negative side effects as companies compete with each net domains that are about to be deleted). other while catering to the demand for expired domains. The extent and process of the drop are publicly known There are four distinct scenarios in which domains only in abstract terms as each drop-catch service aims to can change owners: When the current owner sells to a maintain their competitive position. In this paper, we con- new owner while the domain registration is active; when duct the first measurement study of the drop and provide the domain’s sponsoring registrar sells the domain to a as much detail as is possible from an outside vantage new owner while the domain registration is expired but point. Furthermore, we characterise the extent and com- before control of the domain is returned to the registry petitiveness of drop-catch re-registrations on “day 0,” that (pre-release); as an instant re-registration in the very mo- is, the day an expired domain name is deleted. ment the old registration is deleted, using a drop-catch We find that a surprisingly large fraction of deleted do- service; or as a conventional domain registration at any mains (10 % of com) is re-registered on the same day. In later time using any domain name registrar. Regular do- the case of org, the drop lasts only about 30 seconds, main sales are authorised by the owner of the domain but accounts for more than half of all same-day re- and therefore less of a concern from an abuse perspective. registrations of deleted domains. These results show that Medium to long-term domain re-registrations have been re-registrations are frequent and highly competitive. Des- studied before [29, 22]. Pre-release and drop-catch do- pite the significantly higher price, there is a large demand main ownership transfers, however, are barely mentioned for drop-catch domains. In fact, there seems to be an in the literature, and we are not aware of any systematic arms race between drop-catch services that has been in- measurement or quantification of these phenomena. tensifying recently, with the Top 3 now controlling 75 % There is an entire ecosystem of services attempting of accredited registrars. Drop-catch causes at least 80 % to monetise and profit from expired domains. Many do- of domain creation attempts, yet only a tiny fraction are main registrars such as GoDaddy auction off their own eventually successful. The higher prices paid for drop- customers’ expired domains (without their collaboration); catch domains suggest that their new owners consider when sold, these domains maintain their current registra- them to be valuable; however, in our cursory analysis of tion and are simply made over to the new owner. From a domain uses, we show that most re-registered drop-catch security perspective, such pre-release domains are prob- domains contain nothing but advertisements and parking lematic because they retain their original creation dates pages, suggesting monetisation through residual traffic and exhibit only very limited cues as to the new owner- and speculative re-registrations. Our findings raise the ship. For instance, pre-release domains subvert proactive question of whether these uses justify the risks associated creation-time domain blacklisting mechanisms such as with domain ownership changes without the explicit con- Predator [21], which is related to a similar technique used sent of the prior registrant; they furthermore illustrate that by the commercial Spamhaus blacklist, because the own- security mechanisms must account for domain deletions ership change does not involve a new registration. This and re-registrations as a frequent phenomenon (e.g., more example illustrates the need for a thorough study of how than 20 % of all com domains are deleted each year, and commonly pre-release domains are available and sold. out of those, 10 % are re-registered immediately by a new Once expired domains are deleted, they can be re- owner, and many more at a later time). registered on a first-come, first-served basis, and these Our work makes the following contributions: re-registrations can be quite competitive.